“Did you mean to send me payroll?”

Imagine reading that reply from the person who prints your business cards. You chose the right spreadsheet. You typed “Sam” in the To field. You meant Sam Cole in HR, but you selected Sam Reed at the print shop. Both are people you know. Both email addresses work.

A reminder to check the recipient is useful. It still leaves the privacy of everyone on that spreadsheet riding on one click. A better question for your team is: if someone picks the wrong Sam, can he open the file?

Here’s how to answer that question in five minutes, without sending a message or opening a real payroll file.

Minute 1: See what your email suggests

Open a blank draft. Type a first name that several people in your contacts share. Read the full addresses that appear. Is the person you meant to reach the first suggestion? Could you tell from the name alone?

Leave the draft unsent. The point is to see what someone on your team sees on a busy afternoon, when selecting the first familiar name feels perfectly reasonable.

Minutes 2 and 3: Check how your team shares files

Create an empty test document. Open its sharing settings and look at who can access it. If you copied the link into an email right now, who could open it?

An attachment sends a copy to the recipient. An “anyone with the link” setting means whoever receives that link can use it. Neither choice helps much if you select the wrong Sam.

For payroll, choose the setting that restricts access to specific people. Check who already has access, too. If the print supplier can already open the file through a shared folder, sending a restricted link won’t remove that existing access.

Minutes 4 and 5: Agree on one rule

Try this wording with your team:

For payroll and client records, check the full email address in two places: where you grant access to the file and where you address the message.

Those checks do different jobs. The first decides who can open the file. The second decides who receives the email. If you grant access only to Sam in HR and then accidentally email the link to Sam at the print shop, the supplier receives a message but doesn’t get permission to read the spreadsheet. Keep private details out of the email body for the same reason.

Before you finish, ask one person to show how they would share the empty test document. If the setting is hard to find, write down where it is while everyone can see it. That’s more useful than asking the team to remember to “be careful.”

For suspicious messages coming into your inbox, SO Mail helps you review emails and scan links. SO Mail is available on iOS and Google Play. Visit soemailsecurity.com.